Euranova listed in data leak announcement by fog

• Ransomware group: fog
• Country: Belgium
• Sector: Technology
• Announcement date: March 6, 2025

The fog group claims a breach of Euranova

The technology company Euranova has been listed in a data leak announcement published by the threat actor group known as fog. According to a notice published on March 6, 2025, the group claims that data belonging to the organization has been compromised. This announcement follows a claimed attack date of March 5, 2025.

The threat actor has categorized this specific entry as part of a larger collection titled "The 19 biggest gitlabs". This suggests that the group is targeting infrastructure specifically related to version control and development environments. In modern cyberattack patterns, such as double extortion, threat actors often steal sensitive data before encrypting systems, using the threat of public disclosure to pressure organizations into paying a ransom.

Details of the alleged data theft

The fog group claims that approximately 48 GB of data has been obtained from the organization's GitLab infrastructure. This data has reportedly been made available for download by the attackers. Based on the information provided in the announcement, the data set is accessible via both torrent and web links, as indicated by screenshots provided by the threat actor.

The listing specifically identifies the following types of affected information:

• GitLab source code
• Corporate technical data

While the group has provided the size of the data, no specific information was given regarding the exact file count or the specific amount of a ransom demand.

About Euranova

Euranova is a Belgian technology consulting firm specializing in big data, artificial intelligence, and software development. The company provides digital transformation and data-driven solutions to corporate clients.

Potential impact and organizational risks

This alleged leak may pose significant risks to the organization's intellectual property and software development processes. If the leaked data contains source code, it could lead to the discovery of vulnerabilities in the organization's software products, potentially facilitating secondary attacks. Such a scenario is a common concern for technology-driven firms, as exposed code can serve as a roadmap for malicious actors to find flaws in production environments.

Furthermore, as the organization is based in Belgium, the incident may trigger data breach notification requirements under GDPR. Regulatory compliance is a critical concern for companies operating within the European Union when sensitive information is compromised. While public information about the fog group remains limited, it is assessed that such leaks may impact the organization's commercial reputation and lead to targeted phishing campaigns against the company or its clients.

For organizations in the technology and consulting sectors, maintaining robust security posture is essential. Common defensive steps include implementing strict access controls for development environments, utilizing multi-factor authentication, and conducting regular audits of GitLab and other version control systems. Monitoring for unauthorized data exfiltration and ensuring comprehensive logging of administrative actions can also help in detecting and responding to such incidents more effectively.